diff options
| author | Sumit Bose <sbose@redhat.com> | 2016-07-05 11:25:59 +0200 |
|---|---|---|
| committer | Sumit Bose <sbose@redhat.com> | 2016-07-05 12:03:57 +0200 |
| commit | 8b27ace5c972b82cde1e9a6d6f771f28a2999e39 (patch) | |
| tree | 5cc635385247e22e6bbd1f44415a517a38a51f88 /src/providers/ad | |
| parent | 66ee2f40d0c9b526df8fa9ba7061772237b5d9e6 (diff) | |
| download | sssd-ipa_automatic_enterprise.tar.gz sssd-ipa_automatic_enterprise.tar.xz sssd-ipa_automatic_enterprise.zip | |
IPA/AD: globally set krb5 canonicalization flagipa_automatic_enterprise
If Kerberos principal canonicalization is configured in SSSD, currently
it is the default for the IPA provider, a configuration snippet is
generated for the system-wide libkrb5 configuration so that all
kerberized applications will use canonicalization by default.
Resolves https://fedorahosted.org/sssd/ticket/3041
Diffstat (limited to 'src/providers/ad')
| -rw-r--r-- | src/providers/ad/ad_subdomains.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/providers/ad/ad_subdomains.c b/src/providers/ad/ad_subdomains.c index 4a858fd4d..928c4fe93 100644 --- a/src/providers/ad/ad_subdomains.c +++ b/src/providers/ad/ad_subdomains.c @@ -504,11 +504,16 @@ static errno_t ad_subdom_reinit(struct ad_subdomains_ctx *subdoms_ctx) { const char *path; errno_t ret; + bool canonicalize; path = dp_opt_get_string(subdoms_ctx->ad_id_ctx->ad_options->basic, AD_KRB5_CONFD_PATH); - ret = sss_write_krb5_conf_snippet(path); + canonicalize = dp_opt_get_bool( + subdoms_ctx->ad_id_ctx->ad_options->auth_ctx->opts, + KRB5_CANONICALIZE); + + ret = sss_write_krb5_conf_snippet(path, canonicalize); if (ret != EOK) { DEBUG(SSSDBG_MINOR_FAILURE, "sss_write_krb5_conf_snippet failed.\n"); /* Just continue */ |